CVE-2021-25630

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

"loolforkit" is a privileged program that is supposed to be run by a special, non-privileged "lool" user. Before doing anything else "loolforkit" checks, if it was invoked by the "lool" user, and refuses to run with privileges, if it's not the case. In the vulnerable version of "loolforkit" this check was wrong, so a normal user could start "loolforkit" and eventually get local root privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Feb 23, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-256318.8In the LibreOffice 7-1 series in versions prior to 7.1.2, and in the 7-0 series in versions prior to 7.0.5, the denylist can be circumvented CVE-2021-256337.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256347.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256355.5An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to self sign an ODF document, with a signature untruste CVE-2021-256367.5LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the docum CVE-2021-256406.1In Apache Dubbo prior to 2.6.9 and 2.7.9, the usage of parseURL method will lead to the bypass of white host check which can cause open redi CVE-2021-256419.8Each Apache Dubbo server will set a serialization id to tell the clients which serialization protocol it is working on. But for Dubbo versio CVE-2021-256428.8ZKConfigurationStore which is optionally used by CapacityScheduler of Apache Hadoop YARN deserializes data obtained from ZooKeeper without v CVE-2021-256434.9An issue was discovered in Couchbase Server 5.x and 6.x before 6.5.2 and 6.6.x before 6.6.2. Internal users with administrator privileges, @CVE-2021-256447.5An issue was discovered in Couchbase Server 5.x and 6.x through 6.6.1 and 7.0.0 Beta. Incorrect commands to the REST API can result in leake CVE-2021-256454.4An issue was discovered in Couchbase Server before 6.0.5, 6.1.x through 6.5.x before 6.5.2, and 6.6.x before 6.6.1. An internal user with ad CVE-2021-256468.8Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests. This functionality is inte